How Fast Can a Pen Test Start? Realistic Timelines Explained

ByBNW TEAM

Most people don’t go looking for a penetration test out of curiosity. Someone has asked for one, usually with a date attached: a tender response, a customer contract, an insurance renewal. So the first thing you want to know is how soon someone can actually begin.

The honest answer is that it depends, but not on as many things as you might expect.

The short answer

For a standard booking, two to three weeks from agreeing the work to the tester starting is common. That’s the figure many providers quote, although some are quicker when their diary allows.

A fast pen test can cut that dramatically. Where scope, authorisation and access are all settled, a tester can sometimes be mobilised within about a day. More often, a contained scope such as a single web application or an external IP range starts within a week.

That “where everything is settled” condition does most of the work in that sentence.

What “start” actually means

When someone says “we can start next week”, it’s worth asking which date they mean. A pen test has several, and they don’t move together:

  • Earliest start: the day a tester actually begins work.
  • Testing window: how many days of testing, and whether they run back to back or are spread across weeks.
  • Report delivered: when you can hand something to the person who asked for it.
  • Retest completed: when you can show that the issues have been fixed, if your requirement asks for that.

A provider might start quickly but spread the testing over two weeks. Another might start later but finish in three days. Your deadline usually runs against the report date, so that’s the one to focus on.

What affects how soon testing begins

Tester availability is the factor people assume matters most. In practice, it’s rarely the bottleneck. The delays tend to sit on the client side, and a fast pen test only works when these are dealt with early.

  • Someone with the authority to commit your organisation has to sign the rules of engagement. This is the most common cause of delay. If nobody knows who that person is, a tester can sit idle for days.
  • Third-party permission. If your systems are hosted by a cloud provider or managed by an outside company, you may need their written approval. Asking takes minutes. Waiting for a reply can take a fortnight.
  • Scope clarity. A clear list of IP ranges, applications and environments takes an afternoon to prepare. A vague description takes longer to untangle and usually produces a weaker scope.
  • Working test accounts. Testers typically need a couple of accounts per user role. Expired or borrowed credentials on day one waste valuable hours.
  • Your own availability. If the person who answers scoping questions is on leave, everything pauses.

Why the report date matters more than the start date

Starting early feels reassuring, but it doesn’t tell you when you’ll have something to show. Testing takes the time it takes, and the report follows. A common pattern is a report within about five working days of testing finishing.

So if testing takes four days, starting on Monday doesn’t mean a report on Friday. Add the testing days, then the reporting period, and you get a realistic delivery date. If a retest is part of your requirement, add that as well.

How to work backwards from your deadline

Say a customer needs your report by the 30th. Here’s a simple way to plan:

  1. Start with the 30th and subtract a few days as a safety buffer.
  2. Subtract five working days for reporting.
  3. Subtract the number of testing days your scope needs.
  4. Subtract the time needed to sort authorisation and access.

What’s left is the latest date you can realistically begin the process. If that date has already passed, it doesn’t necessarily mean the deadline is impossible. It may mean a smaller scope, an interim attestation letter, or a conversation with whoever set the date.

Questions to ask a provider

Instead of asking “how long is your lead time?”, try asking for specific dates:

  • What is the earliest date you could start on my scope?
  • On which days would testing take place?
  • When would I receive the report?
  • Is a retest included, and when would it happen?

An average lead time can hide the fact that the next free slot is much sooner, or much later.

Final thoughts

How quickly a pen test can start comes down less to the provider’s diary and more to how ready you are. Settle authorisation, permissions, scope and accounts early, and weeks can shrink to days. If you’re working against a deadline and want to know what’s realistic, you can ask about a fast pen test and get a straight answer on dates before committing.